All Issues | Identity Decoded

The 3-Minute Security Audit Every Developer Should Run Before AI Touches Their Code

Symlink attacks, hallucinated packages, and prompt injection are turning your AI pair programmer into an attacker's easiest way in

NHI

You Just Gave Microsoft Permission to Let Strangers Into Your Account. It Took Three Seconds

ConsentFix and ClickFix attacks are turning OAuth consent prompts into skeleton keys — no password theft, no MFA bypass required. Here's how they work and what to revoke today.

Microsoft 365

Nobody Is Talking About AI Agent Skills Yet. They Will Be

Malicious code is now delivered as helpful app features — and 26,000 AI agents just installed one.

third-party integrations

Your Password Is Safe. You're Still Getting Hacked

The attack that broke Microsoft's login doesn't need your password at all.

authentication

The Security Camera Footage of Your Digital Life Is Being Erased While You're Being Robbed

Attackers aren't breaking in anymore. They're deleting the evidence that they were ever there.

defense evasion

The Security Experts Protecting America Just Got Caught Doing the Thing They Tell You Never to Do

CISA left government cloud keys in public GitHub. Microsoft shipped a debug flag to 3 billion phones. Meta's AI gave away Instagram accounts. Same week.

identity

Ransomware Doesn't Break In. It Logs In

The forensics always leads back to the same place — an account that shouldn't have existed, with access it shouldn't have had. Here's what to fix before the 2 AM alert.

identity-security

The Agency Protecting America's Infrastructure Just Leaked the Keys to It on GitHub

CISA left live AWS GovCloud credentials in a public repo named "Private." It sat there for six months. Nobody inside the agency noticed.

Credential Security

Your AI Coding Assistant Just Cloned Your Entire Repository. You Told It To.

Convention files, prompt injection, and why the line between productivity tool and data pipeline just disappeared

Zero Trust